Threats tagged 'ghsa-56r4-wc4h-fr54'

OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 have an authorization vulnerability in the template filter's {{layout}} directive. This flaw allows administrators with content editing rights to embed {{layout}} with arbitrary layout handles, bypassing the whitelist enforcement applied to the {{block}} directive. This can lead to rendering of disallowed blocks and limited information disclosure.